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ABSTRACT : 



Random access memory (RAM) may be provided in a processor 
for implementing 

microcode patches. The patch RAM may loaded by a microcode 
routine that is 

part of the normal microcode contained in a microcode read 
only memory ( ROM ) 

unit of the processor. When the processor powers-up, it uses 
its internal ROM 

microcode only if no patches are installed. If patches are 
installed and a 

microcode line is accessed for which a patch is enabled, the 
patch is executed 

instead of the microcode line. A patch may be enabled by 
setting a match 

register with the address of the microcode instruction line 
in the microcode 

ROM that is to be patched . Whenever the microcode ROM 
address matches the 

contents of a match register, control is transferred to the 
patch RAM. The 

patch RAM may have a plurality of fixed entry points each 
corresponding to a 
different match register. 

38 Claims, 6 Drawing figures 

Exemplary Claim Number: 1 

Number of Drawing Sheets: 6 

Kw ic 



Abstract Text - ABTX (1) : 

Random access memory (RAM) may be provided in a processor 
for implementing 

microcode patches. The patch RAM may loaded by a microcode 
routine that is 

part of the normal microcode contained in a microcode read 
only memory ( ROM ) 

unit of the processor. When the processor powers-up, it uses 
its internal ROM 

microcode only if no patches are installed. If patches are 
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installed and a 

microcode line is accessed for which a patch is enabled, the 
patch is executed 

instead of the microcode line. A patch may be enabled by 
setting a match 

register with the address of the microcode instruction line 
in the microcode 

ROM that is to be patched . Whenever the microcode ROM 
address matches the 

contents of a match register, control is transferred to the 
patch RAM. The 

patch RAM may have a plurality of fixed entry points each 
corresponding to a 
different match register. 



Brief Summary Text - BSTX (17) : 

Another problem with fetching microcode patches from 
external memory, or 

even from internal caches, is performance. In many 
conventional processors , 

the width of data returned by memory or cache accesses is 
smaller than the 

width of microcode instructions fetched from the microcode 
ROM of the 

processor. Thus, if a microcode patch is fetched from 
external memory or from 

a cache, multiple memory accesses will be required to load a 
patched microcode 

instruction, as compared to a single wide fetch from the 
processor's microcode 

ROM . Furthermore, the latency for memory accesses is 
typically much longer 

than for fetches from the internal microcode ROM. Thus, 
microcode patches 

fetched from external memory or cache typically have an 
adverse effect on 

processor performance since fetching such a patch typically 
requires more and 
slower accesses. 



Brief Summary Text - BSTX (19) : 

Another problem with conventional microcode patch 
mechanisms concerns 

triggering the patch. One technique has been to provide a 
tag memory in the 
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processor having one bit for every location in the microcode 
ROM. If a 

particular microcode ROM location is to be patched, then the 
corresponding bit 

is set in the tag memory. However, for typical microcode ROM 
sizes, this 

technique may require thousands of bits of tag memory. 
Additionally, timing 

may be complicated to access all the bits of the tag memory 
for each microcode 

ROM fetch in order to check if a patch is enabled. 



Brief Summary Text - BSTX (22) : 

An amount of random access memory (RAM) may be provided in 
a processor for 

implementing microcode patches. The patch RAM may loaded by 
a microcode 

routine that is part of the normal microcode contained in a 
microcode ROM unit 

of the processor. When the processor powers -up it uses its 
internal ROM 

microcode only if no patches are installed. However, if 
patches are installed 

and if a microcode line is accessed for which a patch is 
enabled, the patch is 

executed instead of the microcode line. 



Brief Summary Text - BSTX (23) : 

A patch may be enabled by setting a match register with 
the address of the 

microcode instruction line in the microcode ROM that is to be 
patched . A 

processor may include several such match registers. Whenever 
the microcode ROM 

address matches the contents of one of the match registers, 
control is 

transferred to the patch RAM. The patch RAM may have a 
plurality of fixed 

entry points each corresponding to one of the match 
registers. Thus, when an 

MROM address matches a match register, control is passed to 
the patch RAM at 

the fixed entry point corresponding to the matching match 
register. To disable 

a match register, its contents may be written with a value 
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that will never 

match any ROM address, e.g. -1. 



Brief Summary Text - BSTX (24) : 

Whenever a match is detected between an MROM address and a 
match register, 

the microcode instruction line from the ROM is disabled and 
control is 

transferred to the appropriate entry point in the patch RAM. 
In some 

embodiments, a delay slot may also be issued from the ROM 
while control is 

being transferred to the fixed entry point in the patch ROM . 
Thus, there may 

be a two cycle bubble in the MROM unit pipeline whenever 
control is transferred 

from the microcode ROM to the patch RAM since both the 
matching address line 

and the delay slot line from the ROM are cancelled. In a 
preferred embodiment, 

the patch RAM is a contiguously addressed extension of the 
microcode ROM . 

Therefore, regular microcode jump or branch instructions may 
be used when 

exiting a patch routine to return to the ROM . Thus, when 
exiting a patch 

routine there is no need to cancel any instructions and patch 
routines may be 

exited and MROM operation resumed with no delay. 

•Detailed Description Text - DETX (33) : 

Turning now to FIG. 3, a more detailed illustration is 
provided of a portion 

of MROM unit 34 that illustrates a mechanism for implementing 
patches to the 

microcode. MROM storage 64 may include a read only memory 
( ROM ) portion 64a 

and a patch RAM portion 64b. The ROM portion 64a is where 
microcode 

instruction lines are typically accessed. In a preferred 
embodiment, ROM 64a 

holds up to 3K microcode lines or triads and patch RAM 64b 
stores up to 64 

triads. In a preferred embodiment, patch RAM 64b exists in 
the same address 
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space as ROM 64a and is addressed contiguously with ROM 64a. 
For example, in 

the embodiment in which the size of ROM 64a is 3072 (3K) 
lines and the size of 

patch RAM 64b is 64 lines, the microcode address range for 
ROM 64a would be 

0x000 to OxBFF and the address range for patch RAM 64b would 
be OxCOO to 0xC3F. 

A line from ROM 64a or patch RAM 64b is selected according to 
an address from 

next address register 94. The selected line is provided to 
output register 80. 

In a preferred embodiment, each line or triad includes 3 
microcode instructions 

OP1, OP2 and OP3 , and a sequence control field. The sequence 
control field may 

include a branch target address and a control portion. The 
control portion may 

include information to determine whether or not the branch 
should be taken. 

The microcode instructions OP1 through OP3 are output to MROM 
early decode 66. 



Detailed Description Text - DETX (35) : 

The address from next address register 94 is also supplied 
to a comparator 

84 . Comparator 84 compares the address to values stored in a 
number of match 

registers 88. In one embodiment, match registers 88 include 
eight match 

registers where each match register stores 12 bits 
corresponding to a location 

in the 12 bit address space of MROM storage 64. Values are 
programmed into the 

match registers as described below. If the address from next 
address register 

94 matches one of match registers 88, then a patch from patch 
RAM 64b will be 

implemented. When an address from next address register 94 
matches the address 

stored in one of match registers 88, comparator 84 selects a 
corresponding 

patch RAM address from look up table 90. The selected 
address in look up table 

90 is supplied to MUX 86. In a preferred embodiment, the 
addresses in look up 
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table 90 are hard wired to correspond to particular ones of 
match registers 88. 

An example of look up table values for particular match 
registers for one 
embodiment is as follows: 



Detailed Description Text - DETX (37) : 

Thus, when the next MROM storage address matches one of 
match registers 88, 

the MROM access sequence jumps to the address indicated by 
look up table 90. 

The microcode line that was fetched from ROM 64a into output 
register 80 is 

cancelled and a patch from patch RAM 64b is executed instead 
starting from the 

address indicated by look up table 90. Any delayed branch 
effects from jumping 

to the patch RAM are also cancelled. For example, in 
embodiments where 

branches are delayed by one cycle, both the line from ROM 64a 
that triggered 

the patch and the next line (the branch delay slot) are 
cancelled. Thus, in 

such an embodiment, whenever MROM unit 34 switches to a 
microcode patch in 

patch RAM 64b a two-cycle bubble in the MROM pipeline will be 
incurred. 



Detailed Description Text - DETX (39) : 

In a preferred embodiment, the patch RAM locations 
indicated by look up 

table 90 form a vector table that points to a location in the 
rest of patch RAM 

64b where the rest of the patch routine is located. In the 
example described 

above for look up table 90, the vector table entry points are 
located at every 

other address (e.g. offsets 00, 02, 04. . . ) to allow for 
branch delay slots 

at the intervening addresses (e.g. offsets 01, 03, 05. . .) 



Detailed Description Text - DETX (4 0) : 

Once control is transferred to patch RAM 64b execution 
continues from patch 
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RAM 64b until a patch line jumps back into the ROM . In a 
preferred embodiment, 

in which the patch RAM exists as part of the MROM address 
space, a jump from 

the patch RAM 64b to ROM 64a may be treated as any other 
microcode jump or 

branch. Thus, while there may be a two cycle bubble when 
entering the patch 

RAM 64b as described above, there is no delay when jumping 
back to ROM 64a from 

patch RAM 64b. There is no delay when jumping back to ROM 
64a because there is 

no need to cancel a patched microcode line or branch delay 
slot . The patch 

routine simply includes a normal microcode jump with a ROM 
target address. 

Detailed Description Text - DETX (41) : 

Thus, using the mechanism described above in FIG. 3, any 
microcode line of 

ROM 64a may be patched by a routine loaded in patch RAM 64b. 
To invoke a 

patch, one of match registers 88 is programmed with the 
address corresponding 

to the line of MROM 64a desired to be patched. Note that the 
sizes and address 

ranges of ROM 64a and patch RAM 64b described above were 
merely examples for 

certain embodiments, other sizes may be employed as desired. 
Similarly, the 

number of match registers may be varied. Additionally, 
instead of being hard 

wired, in some embodiments look up table 90 may be 
programmable. Also note 

that sequencer 92, MUX 86, incrementer 82, look up table 90, 
match registers 88 

and comparator 84 may all be considered to be part of 
sequence controller 65 
from FIG. 2 . 



Detailed Description Text - DETX (48) : 

The header may also include a flag to indicate that a 
particular patch 

should be executed immediately after the patch RAM is loaded. 
In the example 
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above, an init flag is included for this purpose. When this 
flag is set it 

causes a jump to a particular patch RAM location immediately 
after patch RAM 

64b is loaded. This feature allows the patch RAM to contain 
a microcode 

routine that is run immediately after the patch is loaded and 
before normal 

processor operation resumes. Such a patch routine that is 
executed immediately 

after loading the patch RAM may be useful for fixing or 
changing internal 

processor values that are not associated with microcode ROM 
routines and 

therefore cannot be patched by setting one of match registers 
88 to correspond 

to a line in ROM 64a. For example, it may be necessary to 
change an internal 

processor configuration register to disable a hardware 
optimization that has 

been determined to be faulty. A microcode patch may be 
loaded into patch RAM 

64b to appropriately change the internal configuration 
register. That patch 

may be placed at the init entry point which is jumped to 
after the patch RAM is 

loaded when the init flag is set. Typically this type of 
patch only needs to 

be run once, such as during a power- up software routine. 
When such a patch is 

loaded and the init flag is set, the microcode patch RAM 
loader will notice 

that the init flag is set and jump to the init entry point 
and the patch will 

be executed. Note that this mechanism provides a second way 
to enter patch RAM 

64b in addition to using match registers 88. In a preferred 
embodiment , the 

init entry point in patch RAM 64b is a fixed location. This 
mechanism may be 

used to fix other processor bugs in addition to bugs in the 
microcode itself. 



Detailed Description Text - DETX (50) : 

The header also includes values for the match registers 
88 . The match 

register values may indicate an address value for each match 
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register which is 

to trigger a patch. The address value to be loaded in a 
particular match 

register corresponds to the address of a line or triad in ROM 
64a. As 

described, if ROM 64a is accessed at an address matching an 
address loaded in 

one of the match registers, then a patch is executed from 
patch RAM 64b instead 

of the accessed ROM line and/or delayed branch slot from the 
ROM . In a 

preferred embodiment, each match register indicates a fixed 
entry point into 

patch RAM 64b as described above. A match register and its 
corresponding patch 

may be disabled by setting the value in the microcode patch 
block header for 

that match register with a value that will not match any MROM 
address. In a 

preferred embodiment, a match register is disabled by setting 
it to -1 (e.g. 
OxFFF) . 



Detailed Description Text - DETX (55) : 

Turning now to FIG. 4, a diagram is provided illustrating 
a method of 

operation for microcode patching. One or more patches are 
loaded into a patch 

RAM, such as patch RAM 64b of FIG. 3, as indicated at 100. 
In one embodiment, 

the one or more microcode patches may be stored in the system 
memory of a 

computer system. A microcode patch loader stored in 
microcode ROM 64a (FIG. 3) 

may be called to load the microcode patch data from the 
system memory into the 

microcode patch RAM. Also, as indicated at 100, values are 
set for match 

registers. These values may also be read from system memory, 
such as in the 

microcode patch header described above. An MROM routine may 
begin (102) . 

During the execution of MROM routines, MROM addresses are 
generated in the 

microcode unit to access microcode instruction lines in the 
microcode memory 
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(104) . As each MROM address is generated, the address is 
compared to the match 

registers, as indicated at 106. If no match is detected (at 
108) , the 

addressed microcode line is dispatched from the microcode 
memory (e.g. ROM 64a) 

to be decoded and executed and normal operation continues, as 
indicated at 118 . 

However, if a match is detected (at 108) , the microcode unit 
jumps to a patch 

RAM location corresponding to the matching match register, as 
indicated at 110 . 

Any MROM line and delayed branch slots that were dispatched 
from the microcode 

ROM when the address that triggered the match was generated 
are cancelled, as 

indicated at 112. Thus, instead of executing the microcode 
instruction line 

indicated by the address that matched one of the match 
registers, a patch is 

executed from the patch RAM, as indicated at 114. Upon the 
completion of the 

patch, the patch routine jumps back to the microcode ROM/ as 
indicated at 116. 

Typically the patch will jump back to the next ROM address 
that would have been 

accessed from the microcode ROM before the patch was 
initiated. Note that the 

diagram of FIG. 4 is merely illustrative of the logical 
operation of a 

microcode patching method according to one embodiment. FIG. 
4 is not meant to 

necessarily imply a specific pipeline sequence of operations. 



Detailed Description Text - DETX (56) : 

Turning now to FIG. 5, a diagram is provided illustrating 
a method for 

loading microcode patches. First, any desired microcode 
patches are written 

and assembled (into a microcode patch block (MPB) for 
example) as indicated at 

120. Typically, such patches are written and assembled by a 
processor 

manufacturer. However, in some embodiments users may be able 
to write and 

assemble their own patches. Typically a microcode patch is 
written and 
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assembled like other microcode routines. However, the 
microcode patches may be 

formatted in a particular format, such as described above in 
which the patches 

are located in a microcode patch block having a header and a 
patch data 

portion. Typically system software, such as an operating 
system or BIOS, 

stores the microcode patch block in system memory, as 
indicated at 122. In 

some embodiments, the patch block may be made accessible only 
in certain 

processor mode(s) and/or current privilege level (s) (CPL) . 
The microcode 

patches may then be loaded into the patch RAM. This may be 
accomplished by 

calling a microcode patch RAM loader, as indicated at 124. 
In a preferred 

embodiment, the patch RAM loader is a microcode routine 
stored in the microcode 

ROM . In a preferred embodiment, the patch RAM loader 
function is called via a 

write to a model specific register with another register 
pointing to the 

microcode patch block in system memory. The MSR used to 
invoke the patch RAM 

loader (PRL) may be referred to as MSR PRL, and the register 
used to point to 

the location of the patch block in memory may be referred to 
as the pointer 

register. Thus, to load a microcode patch block, the linear 
address of the 

start of the microcode patch block in system memory is loaded 
in the pointer 

register and a write model specific register (WRMSR) 
instruction to MSR PRL is 

executed, as also indicated at 124. The patch RAM loader 
then installs the 

patch data as indicated at 126. In one embodiment, paging 
and segmentation are 

arranged such that the patch RAM loader does not encounter 
any page faults or 

segmentation faults while accessing the microcode patch block 
in system memory. 

This allows the microcode patch loader routine to be 
simplified. If the patch 

data is successfully installed, a processor register may be 
updated with a 
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patch ID from the microcode patch block header to indicate 
the successful 

installation, as also indicated at 126. In a preferred 
embodiment, this 

register is MSR 8Bh. The microcode patch RAM loader then 
checks to see if the 

init flag from the microcode patch block header is set, as 
indicated at 128. 

If the flag is not set, then the patch installation is 
complete and normal 

processor operation resumes, as indicate at 132. If the init 
flag is set, then 

an init patch is executed, as indicated at 13 0. For example, 
if the patch RAM 

loader determines that the init flag is set, it jumps to a 
fixed location, e.g. 

OxCIO, which locates the beginning of the initialization 
patch. . As mentioned 

above, executing such an initialization patch may be 
desirable if it is 

necessary to fix or change something in the processor that is 
not associated 

with a ROM microcode routine, and therefore a normal patch 
using the match 

registers cannot be triggered. For example, if one of the 
internal 

configuration registers of the processor needs to be changed 
in order to 

disable a faulty hardware optimization, an initialization 

patch may be executed 

to implement that change. 



Detailed Description Text - DETX (57) : 

Typically the loading of the patch data into the patch RAM 
is performed by 

the system software or BIOS during initialization of the 
processor, e.g. after 

power-up or reset. However, in some embodiments, a software 
application may 

load a patch into the patch RAM and use the patch to redefine 
certain lines of 

microcode instructions in the microcode ROM . For example, an 
application could 

use a patch to redefine a microcoded instruction by setting a 
match register to 

the address that indicates the beginning of the microcode 
routine to implement 
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the microcoded instruction that is intended to be redefined. 
The application 

can then provide its own microcode as a patch to change the 
definition of the 

instruction. However, in typical embodiments, the microcode 
patch block ID ' s 

are not made available to application users and the microcode 
patch block data 

is encrypted so that the use of microcode patches may be 
controlled. 
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The present invention teaches a variety of methods, 
apparatus and data 

structures for providing data driven patching. According to 
one embodiment, 

patches are stored in a known format in a discernible 
location. In the 

described embodiment, each fragment code may have a 
corresponding patch 

library. This enables the patches to be located and analyzed 
in a quiescent 

state. In a method aspect of the present invention, the 
operating system, or a 

separate utility program, can evaluate and selectively add 
patches . Therefore , 

the present invention introduces a patch integrity validation 
layer into the 

patching process. In another method aspect, the invention 
teaches evaluating 

the patches in a quiescent state whereby the patches 
introduced by a program or 

a combination of programs may be exhaustively evaluated prior 
to execution. 

41 Claims, 14 Drawing figures 
Exemplary Claim Number: 1 
Number of Drawing Sheets: 10 



KWIC 



Brief Summary Text - BSTX (9) : 

The system routines for the 68K operating system reside 
mainly in ROM. 

However, to provide flexibility for any subsequent 
development , application 

code written for execution within the 68K operating system 
must be kept free of 

any specific ROM addresses. For this reason, all calls to 
system rout ines are _ . __ 

passed * indireqtly through a trap table . resident iiv RAM . This 
indirect 

mechanism permits the ROM addressing of system routines to 
vary, or to be 

replaced by patch routines, without affecting the operation 
of applications 
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which utilize the system routines. 

Brief Summary Text - BSTX (10) : 

The 68K patching paradigm 100 includes application code 
102 having at least 

one ATRAP instruction 104, low memory locations 106, a trap 
dispatcher 108, a 

trap table 110, ROM 12 0 having system code 122, and RAM 130 
including at least 

one patch code 132 . While the operating system routines 
reside mainly in ROM 

120 (in their original state) , information regarding the 
locations of the 

operating system routines is encoded in compressed form 
within ROM 120. Upon 

system start up, this information is decompressed and the 
trap table 110 is 
formed in RAM 13 0. 



Brief Summary Text - BSTX (16) : 

One example of a redirection to a patched system routine 
is symbolized in 

FIG. 2 by dashed flow control lines 150 and 152. Similar to 
the non-patched 

system routine described previously, an ATRAP instruction 104 
calling a patched 

system routine will initiate a process in which the trap 
dispatcher 108 will 

look up the system routine corresponding to the ATRAP 
instruction 104. 

However, in the patched case, address . sub .- - 1 will point to 
patch code 132 

located in RAM 130 rather than the original system routine. 
Thus dashed flow 

control line 150 illustrates jumping to the patch code 132 
and dashed flow 

control line 152 illustrates jumping back to the application 
code 102 after the 

patch code 132 has finished executing. 
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